8.1 ipfw
Добавлено: 2011-02-01 18:02:08
странно на 7.3 все пахало. вот шлюз собран на 8.1 и не пингуется да же на самом шлюзе
А вот когда правила выключаю все пингуется.
cat rc.firewall
rc.conf
ifconfig
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536 - вот этого раньше небыло в 7.3 это что))
А вот когда правила выключаю все пингуется.
Код: Выделить всё
Firewall rules loaded.
/etc/netstart: /etc/rc.d/ip6fw: not found
add net default: gateway 91....
Additional routing options: IP gateway=YES.
KR#
Код: Выделить всё
#!/bin/sh
fwcmd="/sbin/ipfw"
##
oif="rl1"
onet="91..../28"
oip="91..."
##
iif="rl0"
inet="192.168.19.0/24"
iip="192.168.19.1"
##
${fwcmd} -f flush
${fwcmd} -f pipe flush
${fwcmd} -f queue flush
##
${fwcmd} add 95 allow ip from any to any via lo0
${fwcmd} add 96 allow ip from any to any via tun0
${fwcmd} add 100 deny icmp from any to any frag
${fwcmd} add 102 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${fwcmd} add 103 deny ip from any to 172.16.0.0/12 in via ${oif}
${fwcmd} add 104 deny ip from any to 240.0.0.0/4 in via ${oif}
##
##Realizacia NATD
${fwcmd} add 500 divert natd all from ${inet} to any out via ${oif}
${fwcmd} add 800 divert natd all from any to ${oip} in via ${oif}
##
${fwcmd} add 900 allow tcp from any to any established
${fwcmd} add 901 allow ip from ${oip} to any out xmit ${oif}
##
${fwcmd} add 1100 allow udp from any 53 to any via ${oif}
${fwcmd} add 1200 allow udp from any to any 53 via ${oif}
${fwcmd} add 1210 allow icmp from any to any icmptypes 0,8,11
##
${fwcmd} add 1300 allow tcp from any to any via ${iif}
${fwcmd} add 1400 allow udp from any to any via ${iif}
${fwcmd} add 1500 allow icmp from any to any via ${iif}
##
Код: Выделить всё
firewall_enable="YES"
firewall_login="YES"
firewall_type="open"
#firewall_natd_enable="YES"
firewall_script="/usr/local/etc/rc.firewall"
ifconfig
Код: Выделить всё
ifconfig
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:0e:a6:65:11:45
inet 192.168.19.1 netmask 0xffffff00 broadcast 192.168.19.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
rl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:50:ba:b4:d0:55
inet 9 netmask 0xfffffff8 broadcast
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=3<RXCSUM,TXCSUM>
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
